Network security system

ABSTRACT

A network security device is disclosed which does not require a separate computer to implement. The device may be in the form of a boxed hardware component and is preferably configured from an HTML interface. It contains and uses three network cards. The first two cards ( 80, 110 ) are used for the firewall. A third card is a management interface having a private, not publicly routed IP address. The first network card forwards packets to a packet filter ( 90 ). Packets which pass the filter ( 100 ) are forwarded to the second network card ( 110 ) and subsequently to their destination. None of these cards have a publicly routed IP address. The device acts as a packet filter which bridges rather than routes or proxies. It may be located between a router and a hub or server machine.

TECHNICAL FIELD

[0001] The invention pertains to a network security device and moreparticularly to a firewall device using packet filtering and bridging.

BACKGROUND ART

[0002] Many network services have been proven exploitable and tools todo so, even for the beginner have become widely available. Even withoutcompromising information, the temporary blackout of a server or networkcan mean many hours of lost work and missed business opportunities.

[0003] Companies connect to the Internet, and exchange data via d ialup;ISDN and leased lines. Furthermore, employees are offered remote accessoptions. However, every incoming connection is likely to have outgoingconnections as well.

[0004] No computer network is completely secure. Like any lock, if it ishuman built it can be human broken. A small security measure may takeout most the amateurs that otherwise would cause an annoyance. On theother hand, a major site should not settle for said small securitymeasures.

[0005] Security is expensive. Dedicated hardware and software has to bepurchased, installed, configured and maintained by either hiring,employing or creating expertise. Often changes have to be made toexisting infrastructure requiring more hardware or causing downtime.

[0006] Glossary of Terms

[0007] Bridge

[0008] A device which forwards traffic between network segments based ondata link layer information. These segments would have a common networklayer address.

[0009] Firewall

[0010] A dedicated gateway machine with special security precautions onit, used to service outside network, especially Internet connections anddial-in lines. The idea is to protect a cluster of more looselyadministered machines hidden behind it from crackers. The typicalfirewall is an inexpensive microprocessor-based unit machine with nocritical data, with modems and public network ports on it, but just onecarefully watched connection back to the rest of the cluster.

[0011] Router

[0012] A device which forwards packets between networks. The forwardingdecision is based on network layer information and routing tables, oftenconstructed by routing protocols.

[0013] Packets

[0014] The unit of data sent across a network. “Packet” is a genericterm used to describe a unit of data at any layer of OSI protocol stack,but it is most correctly used to describe application later data units(“application protocol data unit”, APDU).

[0015] Packet Filters

[0016] Every packet is compared against the rulebase and based on thematching rule a decision is executed.

[0017] Rule Base

[0018] A set of rules which determines which packets to allow ordisallow through a network.

[0019] HTML: Hypertext Markup Language

[0020] The language used to describe WWW pages.

[0021] A tag-based ASCII language that is used to specify the contentand hypertext links to other documents on World Wide Web servers on theInternet. Browsers made for any operating system, (hardware platform,monitor resolution, etc.) can then be used to view the prepareddocuments and follow links to display other documents.

[0022] Network Interface Card (Network Card)

[0023] A name for the LAN Adaptor (printer circuit board) installed in aPC, that enables it to communicate over a LAN. The term is used commonlyby IBM PC and token ring users.

[0024] IP Address

[0025] All network-layer protocols have an address format, and for the32-bit IP addresses of the TCP/IP protocol, addresses are of the form“199.12.1.1”. This is called dotted decimal, and each of the foursections is a decimal number from 0 to 255, representing 8 bits of theIP address specifies a specific host on that network.

[0026] Since there are only 32 bits to the entire IP address and somenetworks have many more hosts than others (and there are fewer largernetworks), there are different address classes. These allocate differentnumbers of bits to the network and host portion of the address.

[0027] DMZ De-Militarised Zone

[0028] From the military term for an area between two opponents wherefighting is prevented.

[0029] DMZ Ethernets connect networks and computers controlled bydifferent bodies. They may be external or internal. External DMZEthernets link regional networks with routers to internal networks.Internal DMZ Ethernets link local nodes with routers to the regionalnetworks.

[0030] Current Technology

[0031] Many different types of firewall and security software are known.They can be broken down to three categories. (We do not considerpersonal firewalls protecting a single home computer).

[0032] Proxy based: The firewall serves as an application-proxy betweensystems that physically connect to different network interfaces on thefirewall server. An application-proxy acts as an agent or substitute atthe application level for entities that reside on one side of thefirewall when dealing with entities on another side of the firewall. Bymaintaining this separation between interfaces, and continuouslyprotocol checking, provides a very secure environment. This is demandingon CPU time and this can become an issue in high volume sites.

[0033] Stateful inspection: Whenever the firewall receives a packetinitiating a connection, that packet is reviewed against the firewallrule base in sequential order. If the packet goes through any rulewithout being accepted, the packet is denied. If the connection isaccepted, the session is then entered into the Firewall's statefulconnection table, which is located in memory. Every packet that followsis then compared to the stateful inspection table. If the session is inthe table, and the packet is part of that session, then the packet isaccepted. If the packet is not part of the session then it is dropped.This improves system performance, as every single packet is not comparedagainst the rule base.

[0034] Packet filters: Every packet is compared against the rulebase andbased on the matching rule or rules a decision is executed.

[0035] Most of the high-end firewalls provide combinations or hybrids ofthe above-mentioned techniques. All known examples have in common, thatthey are technically routers and need to have different subnets on eachnetwork interface.

[0036] Router vs. Bridge

[0037] A router is a device that forwards packets between networks. Therouter is aware of different networks and how to get there. This is thetechnique currently used by all known commercial firewalls. This impliesthat hosts on a different side of the firewall have to have a differentnetwork address, as the traffic will otherwise never end up at thefirewall. Network changes needed on the dial-in device as well as on theLAN.

[0038] A bridge is a device that forwards traffic between networksegments based on data link layer information. It works based on the MACaddress.

[0039] The present invention emerged from a real life situation where acompany wanted to protect their dial-in server. That server alreadyprovided network connectivity for employees and third parties. A newthird party company needed access, but it was known that that companyhad an insecure Internet connection.

[0040] Implementing any sort of conventional firewall would have meantreconfiguring the addressing-scheme of the dial-in server andcoordinating changes with the remote companies.

DISCLOSURE OF THE INVENTION

[0041] Accordingly the need exists for a security device which requiresno changes to existing infrastructure. Also required is a fullytransparent firewall. The systems of the present invention will nevershow in traceroute, as it is not a logical part of the network. Further,the invention may be implemented without assigning an IP address to it.This means console access for configuration but results in a securitydevice without an address.

[0042] Accordingly, there is provided, a network security device whichdoes not require a separate computer to implement. The device ispreferably configured from an HTML interface and uses three networkcards. The first two cards are used for the Firewall. A third card is amanagement interface having a private, not publicly routed IP address.The first network card forwards packets to a packet filter. Packetswhich pass the filter are forwarded to the second network card andsubsequently to their destination. None of these cards have a publiclyrouted IP address. The device acts as a packet filter which bridgesrather than routes or proxies. It may be located between a router and ahub or server machine.

BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order that the invention may be more readily understood andput into practical effect, reference will now be made to theaccompanying drawings in which:

[0044]FIG. 1 is a flow chart illustrating how the system of the presentinvention is configured,

[0045]FIG. 2 is a flow chart illustrating how network traffic enters aninternal network through the system of the present invention,

[0046]FIG. 3 is a flow chart illustrating how internal network trafficpasses through the system of the present invention into the externalworld,

[0047]FIG. 4 is an illustration of the graphical user interface whichprovides a user with editorial control over a packet filtering rule set.

MODES FOR CARRYING OUT THE INVENTION

[0048] Implementation of the invention requires, for example:

[0049] Hardware

[0050] Minimum 200 Mhz Processor

[0051] Min 64 MB RAM

[0052] One solid-state hard drive of 64 MB Capacity

[0053] 3 ×Network Cards 10/100/1000

[0054] Case with power supply and LCD panel with input device for systemconfiguration. Serial port for debugging and startup information as wedo not use a video card.

[0055] Software

[0056] Linux Kernel Version 2.2.20

[0057] Apache Web Server 1.3.22 mod_perl mod_SSL

[0058] Perl Version 5.6.1

[0059] OpenSSH+OpenSSL

[0060] GNU Tools and utilities needed for running SYS V Linux OS

[0061] Web Interface using mod_perl, HTML and CSS

[0062] Installation is accomplished by creating a computer using thehardware listed in the “Hardware” section above. A detailed system builddescription can be found in appendix A.

[0063] As shown in FIG. 4, the invention comprises a configurationinterface, which include two parts:

[0064] Firewall Configuration

[0065] System Monitoring

[0066] Firewall Configuration

[0067] 1. The interface 10, uses plain text configuration files 20,manipulated through a CGI 50, that contain the ruleset.

[0068] 2. The configuration files are manipulated by Perl scripts thatare accessed through an HTML interface.

[0069] 3. The configuration files are then translated 30 into the kernelrules 40 by Perl scripts.

[0070] A detailed configuration description can be found in appendix B.

[0071] System Monitoring

[0072] 1. Monitors LOAD status. This will tell the users what thecurrent load on the CPU is.

[0073] 2. Monitors Disk Space Status. This will tell the users what thecurrent level of Disk Space Usage is.

[0074] 3. Monitors CONFIGURATION status. This will tell the userswhether or not the changes they have made to the configuration of thefirewall have been committed to the firewall.

[0075] 4. Monitors and Logs whether or not packets have been allowed ordenied.

[0076] As shown in FIG. 2, the inward flow of information comprises aflow of packets. A packet comes into the network 60 from the world 70.It then passes through the first network card 80. The packet is theninspected by the packet filter 90 and compared to the rules. If thepacket is accepted 100 it will be then forwarded to the second networkcard 110 and through to the network 60. If the packet is denied 120 itwill then be dropped 130 which means that it disappears. A log canrecord what happened to the packet.

[0077] As shown in FIG. 3, an outbound packet goes out to the world 70from the network 60. It then passes through the second network card 110.The packet is then inspected by the packet filter 90 and compared to theruleset. If the packet is accepted 100 it will be then forwarded to thefirst network card 80 and through to the world. If the packet is denied120 it will then be dropped 130 which means that it disappears. The logcan record what happened to the packet.

[0078] The following table compares the features of the presentinvention to two other commercial products. Present Invention FireBoxII ™ Firewall I ™ & Raptor ™ 1. All-in-One Network Security All-in-OneNetwork Security Software Based Network Device that requires no otherDevice that requires no other Security Device devices to protect anetwork or devices to protect a network or Require: Extra Hardware (asegment of a network segment of a network computer) & Extra Software (anoperating system) 2. HTML Interface for HTML Interface for Uses its ownInterface for Configuration which means that Configuration which meansthat configuration which means it can be configured from any it can beconfigured from any that it can only be configured computer that has abrowser computer that has a browser from a computer that has the withoutinstalling any additional without installing any additional softwareinstalled on it. software software 3. Uses 3 Network Cards- Uses 3Network Cards Uses at least 2 Network Management Interface with DMZCards. Can uses as many as dummy internal IP address Local supported byhardware and No IP Address Internet OS combination. No IP AddressInternal External 4. Requires No IP Addresses on Requires MultipleRelevant IP Requires Multiple Relevant IP the protected segmentsAddresses Addresses 5. Uses Packet Filtering Uses Packet FilteringFirewall Uses Stateful inspection and Firewall Technology Technologyproxy Firewall Technology 6. Checks Packet and then Checks Packet andthen Routes Checks Packet and then Bridges it (Completely it Routes itTransparent)

[0079] Firewall I and Raptor require a separate computer with anoperating system before they can run and is therefore very different tothe other two firewalls. The present invention uses 3 Network Cards:

[0080] Management Interface with dummy internal IP address

[0081] This Network Card is only used to configure the firewall. It isnot used in the operation of the firewall in any way and has no IPaddress. The other two network cards 810, 110 do not have an IP addresssigned to them.

[0082] This is the greatest difference between the invention and anyknown Firewall on the market. Because the present inventive solutiondoes not use IP addresses, it is not a logical part of the network. Thismeans that it cannot be detected and that it can be implemented simplyby disconnecting an existing interface and plugging this in the middle.No other network reconfiguration is required. This makes it completelyunique.

[0083] The Firebox™ uses 3 Network Cards and requires 3 relevant IPaddresses. This means that the Network needs to be reconfigured to allowfor the installation of this product. Firewall I™ and Raptor™ use 2Network Cards and require 2 relevant IP addresses. This means that theNetwork needs to be reconfigured to allow installation of theseproducts.

[0084] The present invention checks a packet and then bridges it, whichis completely transparent. The Firebox™ checks a packet and then routesit. Firewall I™ and Raptor™ check the packet and then route it. Raptor™checks the requests and then proxies it. All three firewalls check apacket. One significant difference is that the present invention willbridge it rather than route it.

[0085] As shown in FIG. 4, a rule set 90 can be edited through agraphical user interface 200. All rules 210 are given an order. Thisorder may be modified at any time. The rules 210 are checked by thecomputer, one at a time, in order. If a packet satisfies a rule 210 itwill be actioned 230 as determined by the rule, otherwise it will go toa default rule. The rule set tabs into account the packet source 220,the destination 240, the relevant service 250 and options 260 such aslogging requirements. Graphical buttons 270, 280 easy user editing ordeletion.

Appendix A

[0086] Embedded System Build Description:

[0087] The reason for having an embedded Linux system is to take awayany administrative overhead for the user who might not be familiar withthe Linux operating system. Furthermore we eliminate issues like filesystem corruption when the system is powered off rather then shut downproperly.

[0088] We use a separate machine to build the OS. This system contains adevelopment environment, which allows us to build the necessarybinaries, and shared libraries for our production machine.

[0089] On the build machine a separate partition exists which emulatesthe final destination of the OS (the solid state drive).

[0090] The following root directory structure is created: /bin (systembinaries) /boot (kernel directory) /dev (device character devices) /etc(configuration files) /home (home directories) /lib (share libraries)/proc (proc filesystem mount point) /root (root home directory) /sbin(system binaries) /tmp (tmp space mount point) /usr (usr libraries andbinaries) /var (var mount point)

[0091] We populate the /dev directory with the following requiredcharacter files: crw------- 1 root root 5, 1 Apr 9 14:34 consolecrw------- 1 root root 5, 64 Feb 26 16:52 cuaO crw------- 1 root root 5,65 Feb 26 16:52 cua1 brw-rw---- 1 root disk 3, 0 Feb 26 16:52 hdabrw-rw---- 1 root disk 3, 1 Feb 26 16:52 hda1 brw-rw---- 1 root root 3,2 Feb 26 16:52 hda2 brw-rw---- 1 root disk 3, 3 Feb 26 16:52 hda3brw-rw---- 1 root disk 3, 4 Feb 26 16:52 hda4 brw-rw---- 1 root disk 3,5 Feb 26 16:52 hda5 brw-rw---- 1 root disk 3, 6 Feb 26 16:52 hda6brw-rw---- 1 root disk 3, 7 Feb 26 16:52 hda7 brw-rw---- 1 root disk 3,8 Feb 26 16:52 hda8 crw------- 1 root sys 89, 0 Feb 26 16:52 i2c0crw------- 1 root sys 89, 1 Feb 26 16:52 i2c1 prw------- 1 root root 0Apr 4 19:54 initct1 crw-r----- 1 root kmem 1, 2 Feb 26 16:52 kmemcrwxrwxr-x 1 root www 10, 140 Feb 26 16:52 led srw-rw-rw- 1 root root 0Apr 9 14:34 log crw-r----- 1 root kmem 1, 1 Feb 26 16:52 mem crw-rw-rw-1 root root 1, 3 Feb 26 16:52 null crw-r----- 1 root kmem 1, 4 Feb 2616:52 port crw-rw-rw- 1 root root 5, 2 Apr 10 12:53 ptmx drwxr-xr-x 2root root 0 Apr 9 14:34 pts brw------- 1 root disk 1, 0 Feb 26 16:52ram0 brw-rw---- 1 root disk 1, 1 Feb 26 16:52 ram1 brw-rw---- 1 rootdisk 1, 2 Feb 26 16:52 ram2 brw-rw---- 1 root disk 1, 3 Feb 26 16:52ram3 brw-rw---- 1 root disk 1, 4 Feb 26 16:52 ram4 crw-r--r-- 1 rootroot 1, 8 Feb 26 16:52 random crw-rw-r-- 1 root root 10, 135 Feb 2616:52 rtc Irwxrwxrwx 1 root root 17 Mar 18 21:09 stderr −> . . ./proc/self/fd/2 Irwxnvxrwx 1 root root 17 Mar 18 21:09 stdin −> . . ./proc/self/fd/0 Irwxrwxrwx 1 root root 17 Mar 18 21:09 stdout −> . . ./proc/self/fd/1 crw------- 1 root root 4, 0 Feb 26 16:52 systtycrw-rw-rw- 1 root root 5, 0 Mar 18 20:50 tty crw------- 1 root tty 4, 0Feb 26 16:52 tty0 crw------- 1 root try 4, 1 Feb 26 16:52 tty1crw------- 1 root tty 4, 2 Feb 26 16:52 tty2 crw------- 1 root tty 4, 3Feb 26 16:52 tty3 crw------- 1 root tty 4, 4 Feb 26 16:52 tty4crw------- 1 root tty 4, 5 Feb 26 16:52 tty5 crw------- 1 root tty 4, 6Feb 26 16:52 tty6 crw------- 1 root tty 4, 7 Feb 26 16:52 tty7crw------- 1 root tty 4, 8 Feb 26 16:52 tty8 crw------- 1 uucp uucp 4,64 Apr 9 14:34 ttyS0 crw-r----- 1 root tty 4, 65 Feb 26 16:52 ttyS1crw-r--r-- 1 root root 1, 9 Feb 26 16:52 urandom crw-r--r-- 1 root root10, 130 Feb 26 16:52 watchdog crw-rw-rw- 1 root root 1, 5 Feb 26 16:52zero

[0092] We use Linux kernel 2.2.20 (www.kernel.org) enhanced with the OWsecurity patches (www.openwall.com). We replace the existing kernelbridging code with the 2.4 kernel code (bridge.sourceforge.net).

[0093] The kernel is configured with the following parameters:

[0094] #

[0095] # Automatically generated by make menuconfig: don't edit

[0096] #

[0097] CONFIG_X86=y

[0098] #

[0099] # Code maturity level options

[0100] #

[0101] CONFIG_EXPERIMENTAL=y

[0102] #

[0103] # Processor type and features

[0104] #

[0105] # CONFIG_M386 is not set

[0106] # CONFIG_M486 is not set

[0107] # CONFIG_M586 is not set

[0108] CONFIG_M586TSC=y

[0109] # CONFIG_M686 is not set

[0110] CONFIG_X86_WP_WORKS_(—OK=y)

[0111] CONFIG_X86_INVLPG=y

[0112] CONFIG_X86_BSWAP=y

[0113] CONFIG_X86_POPAD_OK=y

[0114] CONFIG_X86_TSC=y

[0115] # CONFIG_MICROCODE is not set

[0116] # CONFIG_X86_MSR is not set

[0117] # CONFIG_X86_CPUID is not set

[0118] CONFIG_(—)1GB=y

[0119] # CONFIG_(—)2GB is not set

[0120] # CONFIG_MATH_EMULATION is not set

[0121] CONFIG_MTRR=y

[0122] # CONFIG_SMP is not set

[0123] #

[0124] # Loadable module support

[0125] CONFIG_MODULES=y

[0126] # CONFIG_MODVERSIONS is not set

[0127] CONFIG_KMOD=y

[0128] #

[0129] # General setup

[0130] #

[0131] CONFIG_NET=y

[0132] CONFIG_PCI=y

[0133] # CONFIG_PCI_GOBIOS is not set

[0134] CONFIG_PCI_GODIRECT=y

[0135] # CONFIG_PCI_GOANY is not set

[0136] CONFIG_PCI_DIRECT=y

[0137] CONFIG_PCI_QUIRKS=y

[0138] # CONFIG_PCI_OPTIMIZE is not set

[0139] CONFIG_PCI_OLD_PROC=y

[0140] # CONFIG_MCA is not set

[0141] # CONFIG_VISWS is not set

[0142] CONFIG_COBALT_GEN III=y

[0143] # CONFIG_COBALT_GEN_V is not set

[0144] # CONFIG_COBALT_BOOTLOADER is not set

[0145] CONFIG_SYSVIPC=y

[0146] # CONFIG_BSD_PROCESS_ACCT is not set

[0147] CONFIG_SYSCTL=y

[0148] CONFIG_BINFMT_AOUT=m

[0149] CONFIG_BINFMT_ELF=y

[0150] # CONFIG_BINFMT_ELF_AOUT is not set

[0151] CONFIG_BINFMT_MISC=m

[0152] # CONFIG_BINFMT_JAVA is not set

[0153] # CONFIG_PARPORT is not set

[0154] # CONFIG_APM is not set

[0155] # CONFIG_TOSHIBA is not set

[0156] #

[0157] # Plug and Play support

[0158] #

[0159] CONFIG_PNP=y

[0160] #

[0161] # Block devices

[0162] #

[0163] # CONFIG_BLK_DEV_FD is not set

[0164] CONFIG_BLK_DEV_IDE=y

[0165] # CONFIG_BLK_DEV_HD_IDE is not set

[0166] CONFIG_BLK_DEV_IDEDISK=y

[0167] # CONFIG_BLK_DEV_IDECD is not set

[0168] # CONFIG_BLK_DEV_IDETAPE is not set

[0169] # CONFIG_BLK_DEV_IDEFLOPPY is not set

[0170] # CONFIG_BLK_DEV_IDESCSI is not set

[0171] # CONFIG_BLK_DEV_CMD640 is not set

[0172] # CONFIG_BLK_DEV_RZ1000 is not set

[0173] CONFIG_BLK_DEV_IDEPCI=y

[0174] CONFIG_BLK_DEV_IDEDMA=y

[0175] # CONFIG_BLK_DEV_OFFBOARD is not set

[0176] CONFIG_IDEDMA_AUTO=y

[0177] # CONFIG_BLK_DEV_OPT1621 is not set

[0178] CONFIG_BLK_DEV_ALI15X3=y

[0179] # CONFIG_BLK_DEV_TRM290 is not set

[0180] # CONFIG_BLK_DEV_NS87415 is not set

[0181] # CONFIG_BLK_DEV_VIA82C586 is not set

[0182] # CONFIG_BLK_DEV_CMD646 is not set

[0183] # CONFIG_BLK_DEV_CS5530 is not set

[0184] # CONFIG_IDE_CHIPSETS is not set

[0185] # CONFIG_BLK_DEV_LOOP is not set

[0186] # CONFIG_BLK_DEV_NBD is not set

[0187] # CONFIG_BLK_DEV_MD is not set

[0188] CONFIG_BLK_DEV_RAM=n

[0189] CONFIG_BLK_DEV_RAM_SIZE=4096

[0190] # CONFIG_BLK_DEV_XD is not set

[0191] # CONFIG_BLK_DEV_DAC960 is not set

[0192] CONFIG_PARIDE_PARPORT=y

[0193] # CONFIG_PARIDE is not set

[0194] # CONFIG_BLK_CPQ_DA is not set

[0195] # CONFIG_BLK_CPQ_CISS_DA is not set

[0196] # CONFIG_BLK_DEV_HD is not set

[0197] #

[0198] # Networking options

[0199] #

[0200] CONFIG_PACKET=y

[0201] CONFIG_NETLINK=y

[0202] # CONFIG_RTNETLINK is not set

[0203] CONFIG_NETLINK_DEV=y

[0204] CONFIG_FIREWALL=y

[0205] # CONFIG_FILTER is not set

[0206] CONFIG_UNIX=y

[0207] CONFIG_INET=y

[0208] # CONFIG_IP_MULTICAST is not set

[0209] # CONFIG_IP_ADVANCED_ROUTER is not set

[0210] # CONFIG_IP_PNP is not set

[0211] CONFIG_IP_FIREWALL=y

[0212] # CONFIG_IP_FIREWALL_NETLINK is not set

[0213] # CONFIG_IP_TRANSPARENT_PROXY is not set

[0214] # CONFIG_IP_MASQUERADE is not set

[0215] # CONFIG_IP_ROUTER is not set

[0216] # CONFIG_NET_IPIP is not set

[0217] # CONFIG_NET_IPGRE is not set

[0218] CONFIG_IP_ALIAS=y

[0219] CONFIG_SYN_COOKIES=y

[0220] # CONFIG_INET_RARP is not set

[0221] CONFIG_SKB_LARGE=y

[0222] # CONFIG_IPV6 is not set

[0223] # CONFIG_IPX is not set

[0224] # CONFIG_ATALK is not set

[0225] CONFIG_BRIDGE=n

[0226] # CONFIG_X25 is not set

[0227] # CONFIG_LAPB is not set

[0228] # CONFIG_NET_DIVERT is not set

[0229] # CONFIG_LLC is not set

[0230] # CONFIG_ECONET is not set

[0231] # CONFIG_WAN_ROUTER is not set

[0232] # CONFIG_NET_FASTROUTE is not set

[0233] # CONFIG_NET_HW_FLOWCONTROL is not set

[0234] # CONFIG_CPU_IS_SLOW is not set

[0235] #

[0236] # QoS and/or fair queueing

[0237] #

[0238] # CONFIG_NET_SCHED is not set

[0239] #

[0240] # Telephony Support

[0241] #

[0242] # CONFIG_PHONE is not set

[0243] # CONFIG_PHONE_IXJ is not set

[0244] #

[0245] # SCSI support

[0246] #

[0247] # CONFIG_SCSI is not set

[0248] #

[0249] # I2O device support

[0250] #

[0251] # CONFIG_I2O is not set

[0252] # CONFIG_I2O_PCI is not set

[0253] # CONFIG_I2O_BLOCK is not set

[0254] # CONFIG_I2O_SCSI is not set

[0255] #

[0256] # Network device support

[0257] #

[0258] CONFIG_NETDEVICES=y

[0259] #

[0260] # ARCnet devices

[0261] #

[0262] # CONFIG_ARCNET is not set

[0263] # CONFIG_DUMMY is not set

[0264] # CONFIG_BONDING is not set

[0265] # CONFIG_EQUALIZER is not set

[0266] # CONFIG_ETHERTAP is not set

[0267] # CONFIG_NET_SB1000 is not set

[0268] #

[0269] # Ethernet (10 or 100 Mbit)

[0270] #

[0271] CONFIG_NET_ETHERNET=y

[0272] CONFIG_NET_VENDOR_(—)3COM=y

[0273] # CONFIG_EL1 is not set

[0274] # CONFIG_EL2 is not set

[0275] # CONFIG_ELPLUS is not set

[0276] # CONFIG_EL16 is not set

[0277] # CONFIG_EL3 is not set

[0278] # CONFIG_(—)3C515 is not set

[0279] CONFIG_VORTEX=y

[0280] # CONFIG_LANCE is not set

[0281] # CONFIG_NET_VENDOR_SMC is not set

[0282] # CONFIG_NET_VENDOR_RACAL is not set

[0283] # CONFIG_RTL8139 is not set

[0284] # CONFIG_RTL8139TOO is not set

[0285] # CONFIG_NET_ISA is not set

[0286] CONFIG_NET_EISA=y

[0287] # CONFIG_PCNET32 is not set

[0288] # CONFIG_ADAPTEC_STARFIRE is not set

[0289] # CONFIG_AC3200 is not set

[0290] # CONFIG_APRICOT is not set

[0291] # CONFIG_LP486E is not set

[0292] # CONFIG_CS89x0 is not set

[0293] # CONFIG_DM9102 is not set

[0294] # CONFIG_DE4X5 is not set

[0295] # CONFIG_DEC_ELCP is not set

[0296] # CONFIG_DEC_ELCP_OLD is not set

[0297] # CONFIG_DGRS is not set

[0298] CONFIG_EEXPRESS_PRO100=y

[0299] # CONFIG_LNE390 is not set

[0300] # CONFIG_NE3210 is not set

[0301] # CONFIG_NE2K_PCI is not set

[0302] # CONFIG_TLAN is not set

[0303] # CONFIG_VIA_RHINE is not set

[0304] # CONFIG_SIS900 is not set

[0305] # CONFIG_ES3210 is not set

[0306] # CONFIG_EPIC100 is not set

[0307] # CONFIG_ZNET is not set

[0308] # CONFIG_NET_POCKET is not set

[0309] #

[0310] # Ethernet (1000 Mbit)

[0311] #

[0312] # CONFIG_ACENIC is not set

[0313] # CONFIG_HAMACHI is not set

[0314] # CONFIG_YELLOWFIN is not set

[0315] # CONFIG_SK98LIN is not set

[0316] # CONFIG_FDDI is not set

[0317] # CONFIG_HIPPI is not set

[0318] # CONFIG_PPP is not set

[0319] # CONFIG_SLIP is not set

[0320] # CONFIG_NET_RADIO is not set

[0321] #

[0322] # Token ring devices

[0323] #

[0324] # CONFIG_TR is not set

[0325] # CONFIG_NET_FC is not set

[0326] # CONFIG_RCPCI is not set

[0327] # CONFIG_SHAPER is not set

[0328] #

[0329] # Wan interfaces

[0330] #

[0331] # CONFIG_HOSTESS_SV11 is not set

[0332] # CONFIG_COSA is not set

[0333] # CONFIG_SEALEVEL_(—)4021 is not set

[0334] # CONFIG_SYNCLINK_SYNCPPP is not set

[0335] # CONFIG_LANMEDIA is not set

[0336] # CONFIG_COMX is not set

[0337] # CONFIG_HDLC is not set

[0338] # CONFIG_DLCI is not set

[0339] # CONFIG_XPEED is not set

[0340] # CONFIG_SBNI is not set

[0341] #

[0342] # Amateur Radio support

[0343] #

[0344] # CONFIG_HAMRADIO is not set

[0345] #

[0346] # IrDA (infrared) support

[0347] #

[0348] # CONFIG_IRDA is not set

[0349] #

[0350] # ISDN subsystem

[0351] #

[0352] # CONFIG_ISDN is not set

[0353] #

[0354] # Old CD-ROM drivers (not SCSI, not IDE)

[0355] #

[0356] # CONFIG_CD_NO_IDESCSI is not set

[0357] #

[0358] # Character devices

[0359] #

[0360] CONFIG_VT=y

[0361] CONFIG_VT_CONSOLE=y

[0362] CONFIG_SERIAL=y

[0363] CONFIG_SERIAL_CONSOLE=y

[0364] # CONFIG_SERIAL_EXTENDED is not set

[0365] # CONFIG_SERIAL_NONSTANDARD is not set

[0366] CONFIG_UNIX98_PTYS=y

[0367] CONFIG_UNIX98_PTY_COUNT=256

[0368] # CONFIG MOUSE is not set

[0369] #

[0370] # Joysticks

[0371] #

[0372] # CONFIG_JOYSTICK is not set

[0373] # CONFIG_QIC02_TAPE is not set

[0374] CONFIG_WATCHDOG=y

[0375] #

[0376] # Watchdog Cards

[0377] #

[0378] # CONFIG_WATCHDOG_NOWAYOUT is not set

[0379] # CONFIG_ACQUIRE_WDT is not set

[0380] # CONFIG_ADVANTECH_WDT is not set

[0381] # CONFIG_PCWATCHDOG is not set

[0382] # CONFIG_(—)1810_TCO is not set

[0383] # CONFIG_MIXCOMWD is not set

[0384] # CONFIG_(—)60XX_WDT is not set

[0385] CONFIG_SOFT_WATCHDOG=m

[0386] # CONFIG_WDT is not set

[0387] # CONFIG_WDTPCI is not set

[0388] # CONFIG_MACHZ_WDT is not set

[0389] # CONFIG_NVRAM is not set

[0390] CONFIG_RTC=y

[0391] # CONFIG_INTEL_RNG is not set

[0392] # CONFIG_AGP is not set

[0393] # CONFIG_DRM is not set

[0394] CONFIG_COBALT_LCD=y

[0395] #

[0396] # Video For Linux

[0397] #

[0398] CONFIG_VIDEO_DEV=m

[0399] # CONFIG_RADIO_RTRACK is not set

[0400] # CONFIG_RADIO_RTRACK2 is not set

[0401] # CONFIG_RADIO_AZTECH is not set

[0402] # CONFIG_RADIO_CADET is not set

[0403] # CONFIG_RADIO_GEMTEK is not set

[0404] # CONFIG_RADIO_MAESTRO is not set

[0405] # CONFIG_RADIO_MIROPCM20 is not set

[0406] # CONFIG_RADIO_TRUST is not set

[0407] # CONFIG_VIDEO_BT848 is not set

[0408] # CONFIG_VIDEO_CPIA is not set

[0409] # CONFIG_VIDEO_PMS is not set

[0410] # CONFIG_VIDEO_SAA5249 is not set

[0411] # CONFIG_RADIO_SF16FMI is not set

[0412] # CONFIG_RADIO_TYPHOON is not set

[0413] # CONFIG_RADIO_ZOLTRIX is not set

[0414] # CONFIG_VIDEO_ZORAN is not set

[0415] # CONFIG_VIDEO_BUZ is not set

[0416] # CONFIG_DTLK is not set

[0417] #

[0418] # Ftape, the floppy tape device driver

[0419] #

[0420] # CONFIG_FTAPE is not set

[0421] #

[0422] # USB support

[0423] #

[0424] # CONFIG_USB is not set

[0425] #

[0426] # Filesystems

[0427] #

[0428] # CONFIGQUOTA is not set

[0429] # CONFIG_AUTOFS_FS is not set

[0430] # CONFIG_ADFS_FS is not set

[0431] # CONFIG_AFFS_FS is not set

[0432] # CONFIG_HFS_FS is not set

[0433] # CONFIG_FAT_FS is not set

[0434] # CONFIG_MSDOS_FS is not set

[0435] # CONFIG_UMSDOS_FS is not set

[0436] # CONFIG_VFAT_FS is not set

[0437] # CONFIG_IS09660_FS is not set

[0438] # CONFIG_JOLIET is not set

[0439] # CONFIG_MINIX_FS is not set

[0440] # CONFIG_NTFS_FS is not set

[0441] # CONFIG_HPFS_FS is not set

[0442] CONFIG_PROC_FS=y

[0443] CONFIG_DEVPTS_FS=y

[0444] # CONFIG_QNX4FS_FS is not set

[0445] # CONFIG_ROMFS_FS is not set

[0446] CONFIG_EXT2 FS=y

[0447] # CONFIG_SYSV_FS is not set

[0448] # CONFIG_UFS_FS is not set

[0449] # CONFIG_EFS_FS is not set

[0450] #

[0451] # Network File Systems

[0452] #

[0453] # CONFIG_CODA_FS is not set

[0454] # CONFIG_NFS_FS is not set

[0455] # CONFIG_NFSD is not set

[0456] # CONFIG_SUNRPC is not set

[0457] # CONFIG_LOCKD is not set

[0458] # CONFIG_SMB_FS is not set

[0459] # CONFIG_NCP_FS is not set

[0460] #

[0461] # Partition Types

[0462] #

[0463] # CONFIG_BSD_DISKLABEL is not set

[0464] # CONFIG_MAC_PARTITION is not set

[0465] # CONFIG_MNIX_SUBPARTITION is not set

[0466] # CONFIG_SMD_DISKLABEL is not set

[0467] # CONFIG_SOLARIS_X86_PARTITION is not set

[0468] # CONFIG_UNIXWARE_DISKLABEL is not set

[0469] # CONFIG_NLS is not set

[0470] #

[0471] # Console drivers

[0472] #

[0473] # CONFIG_VGA_CONSOLE is not set

[0474] # CONFIG_VIDEO_SELECT is not set

[0475] # CONFIG_MDA_CONSOLE is not set

[0476] # CONFIG_FB is not set

[0477] #

[0478] # Sound

[0479] #

[0480] # CONFIG_SOUND is not set

[0481] #

[0482] # Security options

[0483] #

[0484] # CONFIG_SECURE_STACK is not set

[0485] # CONFIG_SECURE_LINK is not set

[0486] # CONFIG_SECURE_FIFO is not set

[0487] # CONFIG_SECURE_PROC is not set

[0488] # CONFIG_SECURE_FD_(—)0_(—)1_(—)2 is not set

[0489] # CONFIG_SECURE_RLIMIT_NPROC is not set

[0490] # CONFIG_SECURE_SHM is not set

[0491] #

[0492] # Kernel hacking

[0493] #

[0494] # CONFIG_MAGIC_SYSRQ is not set

[0495] We build the production kernel. and place it on the destinationpartition in the /boot directory. We then start building the supportingbinaries as needed in order to get a functional SYS V Linux system, webserver and any other tools as desired. After building these binariesthey are placed on the destination partition along with their requiredshared libraries and configuration files. Once all the required binariesare build and functional we use the following setup.

[0496] During the boot process we generate the following ram driveswhich are used by the system for write operations. Obviously RAM isvolatile and the shutdown sequence will take care of storing anyinformation which needs to be available after a reboot or power outage.Since each RAM drive is created and formatted on startup there is nochance for File system corruption upon unclean shutdowns. Drive Mountedas /dev/ram0 swap /dev/ram1 /tmp /dev/ram2 /var /dev/ram3/usr/local/firebridge/http

[0497] swap: used by the OS when physical RAM is running low. (Bygenerating swap space in RAM we reserve that part of memory for swapusage.

[0498] /tmp: Used for temporary files by the management interface

[0499] /var: used for logging (note that logfiles will currently not besaved upon reboot. In order to achieve permanent logging we providesyslog which can log to a loghost)

[0500] /usr/..../http: Used for the webserver's web pages and graphics.In order to achieve fast access and increase interface performance weserve these graphics from RAM as access times are much higher then fromany other device.

Appendix B

[0501] Management Interface and Firewall Configuration Files:

[0502] The CGI interface uses mod_perl and distinguishes between twotypes of files. *.cgi files which deal with what the user sees in thewebbrowser. *-lib.pl files which contain functions for checking userinput and manipulating the configuration files. There are static htmlfiles, images and cascading stylesheets used as a framework for thedynamic content and presentation.

[0503] The following files are used to manipulate the configurationfiles: / - fb-cgilib.pl (general functions used by all scripts) -ipcalc-lib.pl (ip calculator library) - ipcalc.cgi (ip calculatorpresentation) * bridgeview (this contains the read only versions) -vwgroups.cgi - vwnetobjects.cgi - vwrules.cgi - vwservices.cgi * fw -fwconf-lib.pl (write ipchains compatible config based on rules) -fwconf.cgi (activate/roll back configuration) - groups-lib.pl(manipulategroup file) - groups.cgi (presentation for group file) -netobjects-lib.pl (manipulate network objects file) - netobjects.cgi(presentation for network objects file) - rules-lib.pl (manipulate rulesfile) - rules.cgi (presentation for rules file) - services-lib.pl(manipulate services file) - services.cgi (presentation for servicesfile) * logvw - logvw.cgi (view current log file) * options -fbgconf-lib.pl (manipulate global configuration options) - fbgconf.cgi(presentation global configuration options) * status - confstatus.cgi(check if current configuration is identical to active) - loadstanis.cgi(check the load of the box) * wizard - wizard.cgi (step by step creationof rules and related objects)

[0504] Firebridge uses the following configuration files: Actions(Possible actions for a rule) nr:action fbgcfg (Global configurationoptions) option=value (true or false) fbrules (rules by number)nr:allow/deny:source-name:destination-name:service-name:action-nr:comment (note that source/destination/service can be a groupname) groups (groups)name:type:member-name,member-name,member-name:comment netobjects(network entities) name:address/mask protocols (ip protocols by number)nr:name:commentname:description:protocol-nr:source-port:destination-port (ports can beranges separated by a dash, e.g: 1024-65535)

[0505] The Firebridge uses the following directories for it'sconfiguration:

[0506] /usr/local/firebridge/fwconfig/active

[0507] /usr/local/firebridge/fwconfig/config

[0508] Upon boot the system will write the files from ./active to./config which physically lives on the /var ram drive (symbolic link tothe above name). When a user makes changes to the firewall these will berecorded in the ./config directory. Once the user is happy with all thechanges he then selects activate config within the management interface.The system then takes all the files from the ./config and overwrites thefiles in ./active. It then starts creating ipchains compatible outputtranslating groups into multiple rules as desired. When all rules werewritten successfully it activates these in ipchains. Alternatively theuser can select roll back upon which the system will take the files from./active and overwrite the files in ./config.

I claim:
 1. A network security device comprising: three network cards; afirst card and a second card are used for a firewall; a third card is amanagement interface having a private, not publicly routed IP address;the first network card forwards packets to a packet filter and packetswhich pass the filter are forwarded to the second network card andsubsequently to a destination; wherein none of the three cards have apublicly routed IP address.
 2. The device of claim 1, wherein; thedevice configured to act as a packet filter which bridges rather thanroutes or proxies.
 3. The device of claim 1, wherein: the device isadapted to be located between a router and a hub or server machine. 4.The device of claim 1, wherein: the device does not require a separatecomputer to implement.
 5. The device of claim 1, wherein: the device isconfigurable from an HTML interface.
 6. The device of claim 1, wherein:the device is configured with an HTML interface which is supplied withthe device.
 7. The device of claim 1, further comprising: a LOAD monitorwhich provides LOAD status, and for providing a graphic notification toa user of what the current load on the CPU is.
 8. The device of claim 1,further comprising: a CONFIGURATION status monitor, which provides for agraphic notification to a user of whether or not the changes they havemade to the configuration of the firewall have been committed to thefirewall.
 9. The device of claim 1, further comprising: a monitor andlog which provides for a graphic indication of whether or not packetshave been allowed or denied.
 10. The device of claim 1, wherein: apacket passes through the first network card and is then inspected by apacket filter and compared to a set of rules; an accepted packet is thenforwarded to the second network card and thus through to a network ; andwherein a packet which is denied is then be dropped and disappears. 11.The device of claim 1, wherein: an outbound packet passes through thesecond network card where the packet is inspected by a packet filter andcompared to a rule set; an accepted packet is then forwarded to thefirst network card and through to a network; and wherein a packet whichis denied is then be dropped and disappears.
 12. The device of claim 1,further comprising: an HTML interface for configuration such that it canbe configured from any computer to which it is networked that has anHTML browser without installing any additional software.
 13. The deviceof claim 1, wherein: the first and second network cards do not have orrequire an IP address assigned to them.